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Abstract 

The classihcation of quantum symmetric-key encryption protocol is pre¬ 
sented. According to hve elements of a quantum symmetric-key encryption 
protocol: plaintext, ciphertext, key, encryption algorithm and decryption 
algorithm, there are 32 different kinds of them. Among them, 5 kinds of 
protocols have already been constructed and studied, and 21 kinds of them 
are proved to be impossible to construct, the last 6 kinds of them are not yet 
presented effectively. That means the research on quantum symmetric-key 
encryption protocol only needs to consider with 5 kinds of them nowadays. 
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1. Introduction 

In the study of quantum cryptography, it is generally agreed that the clas¬ 
sical cryptography is a special case of the quantum cryptography. When it 
comes to quantum encryption protocol, there are usually two viewpoints: the 
narrow one says that only the encryption algorithm involves quantum parts 
can be called quantum encryption protocol, which is regarded as a counter¬ 
part to the classical encryption protocol; the generalized one says that the 
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classical encryption protocol is a special case of quantum encryption proto¬ 
col, so the concept of quantum encryption protocol should be including the 
classical encryption protocol, and while it has nothing to do with a quantum 
part, it is called a classical one. In this article, we take the second view to 
explain the quantum encryption protocol. If a quantum operation involves 
a classical target x, it means we use the orthogonal basis to code quantum 
state |x) as the target. 

Besides the classical encryption protocol, the most famous quantum en¬ 
cryption protocol is private quantum channel(PQC). It was Boykin[l| who 
hrstly suggested the quantum one time pad, he encrypted n qubits by 2n 
bits classical key with Pauli rotation operations. Then he proved that 2n 
bits classical key was the necessary and sufficient condition of encrypting n 
qubits with unconditional security. Ambainisj^ presented the definition of 
PQC, and proved that two parties share 2n bits classical key is the necessary 
and sufficient condition of transferring n qubits in public channel with uncon¬ 
ditional security, in this manner each qubit is encrypted to a ultimate mixed 
state. Based on this protocol, Ambainisj^ and Hardyj^ separately presented 
a quantum approximate encryption schemes with short keys. Bostrom sug¬ 
gested a protocol, which encrypts classical message with a entangled-state- 
based quantum algorithm}^. 

2. Classification of the Quantum symmetric-key Encryption Pro¬ 
tocol 

A quantum symmetric-key encryption protocol with five elements (P, C, K, 
E,D) : plaintext(P), ciphertext(C), key(P), encryption algorithm(P) and 
decryption algorithm(P), can be divided into 32 classes according to the 
property of each element. Among them, 5 kinds have already been con¬ 
structed and studied, and 21 kinds are proved to be impossible to be con¬ 
struct, the last 6 kinds are not yet presented effectively. That means the 
research on quantum symmetric-key encryption protocol only needs to con¬ 
sider with 5 kinds of them nowadays. The specific classification is shown in 
Tab. 1. 

In Tab. 1, C denotes the element belongs to classical space, Q denotes the 
element belongs to quantum space, E means the protocol is exist, N means 
the protocol is not exist, O means whether this kind of protocol exists or not 
is still an open problem. According to this, we classification the quantum 
symmetric-key encryption protocols into three types. 
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3. Type E 

In this section, five kinds of protocols of type E will be introduced through 
simple examples, the sequence numbers of those protocol are Kind 1, 12, 16, 
28, 32. 

3.1. Kind 1 

Since each element of Kind 1 protocol belongs to classical space, this 
kind of quantum symmetric-key encryption protocol is actually the classical 

a mmetric-key encryption. There is no doubt that this kind is exist. DESj^, 

, AESjsl and other common symmetric-key encryption protocols all belong 
to this kind. 

3.2. Kind 12 

The Kind 12 protocol requests: P, K G C; C,E,D e Q. This kind of 
protocol is relatively researched widely, we give one simple example for it as 
follow: 

PROCOTOL 1 (P, K G C; C, P,P G Q). Let key be k = (^ 1 ,^ 2 ); o.nd 
classical plaintext be x. 

Encryption: 

1. Alice prepares the quantum state |a;)o according to x. 

2. Alice performs quantum operations on |a;)o. 

here \ipf) = Y^^H^^\x)o = (—© ^ 2)^1 

3. Alice sends \ipx) to Bob through quantum channel. 

Decryption: 

1. Bob chooses measurement basis according to ki: 

while ki = 0 , he takes measurement under {\0), | 1 )} basis, else ifki = 1 , 
he takes measurement under {|+), |—)} basis. The result turns out to 
be X ®k 2 with probability 1. 

2. Bob gets x = (x © ^ 2 ) © ^ 2 - 
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3 . 3 . Kind 16 

The Kind 16 protocol requests: P G C, C, K, E, D G Q. This kind 
of protocol often uses EPR pairs ^ (|0)a|0)b + |1)a|1)b) as the key, each 
communication party shares one particle of the EPR pair. According to the 
quantum nature of the key, it can not be copied at all. 

We give an example protocol which encrypt one classical bit each time as 
follow: 

PROCOTOL 2 (P e C, C, K,E,DeQ). 

Let key be ^ (|0)^|0)b + |1)a|1)s); and classical plaintext he x. 

Encryption: 

1. Alice prepares the quantum state = |a;)o according to x. 

2. Alice performs CNOT operation on with the particle in register A. 

|0)a|0)b + |1)a|1)b I V CNOT |0)A|0)B|a;)o + |l)A|l)Bk ® l)o 

- 71 -^- 71 -■ 

3. Alice keeps the particle in register A, and sends the rest to Bob through 
quantum channel. 

Decryption: 

1. Bob performs CNOT operation with the particle in register B on the 
qubit he received. It turns out 

|0)A|0)s|a:)o + |l)A|l)s|a: © l)o cnot |0)a|0)b + |1)a|1)b , « 

- 71 -^- 71 - 

2. Bob takes measurement to the qubit with {|0), |1)} basis, and gets x 
with probability 1. 

3 . 4 . Kind 28 

The Kind 28 protocol requests: K G C, P,C,E,D E Q. This kind 
of protocol aims at the quantum message, the most famous PQC(Private 
Quantum Channel) with unconditional security belongs to it. We give the 
process of PQC as follow: 

PROCOTOL 3 {K G C, P,C,E,D G Q). For one bit quantum plaintext 
p, Alice and Bob need two bits classical key ki,k 2 . 

Encryption: 
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1. Alice performs quantum operation Uk = to encrypt p and gets 

p' = UtpUl 

2. Alice sends p' to Bob through quantum channel. 

Decryption: 

1. Bob performs same quantum operation Ul = on p' and get 

P = UkP'Ul 

This protocol is proved unconditionally secure j^. 

3.5. Kind 32 

The Kind 32 protocol requests all hve elements belong to quantum space. 
We show a simple example as follow: 

PROCOTOL 4 (P,C, K, E, D G Q). Let plaintext be p, and key be pk = 
I (|0)a|0)b + |l)yi|l)B) ((0|yi(0|B + (1 |a(1|b)- Alice obtains the particle in 
register A, and Bob obtains the particle in register B. 

Encryption: 

1. Alice performs CNOT operation on p with her key: 

UE{pk ® p)U\; = - \a) a\o) B{b\A{b\B ® X^^pX^. (3) 

a,6S0,l 

2. Alice keeps the key state and sends the ciphertext state to Bob. 

Decryption: 

1. Bob performs CNOT operation on ciphertext state with his key. It turns 
out: 

Unil \a)A\a)B{b\A{b\B(ZX‘^pX'^)Uj, = pk(Zp. (4) 

a,6S0,l 

2. The plaintext is in the second register. 
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3.6. Quantum key 

It should be mentioned that within the examples of Kind 16 and 32 
protocol, the quantum key is entangled state rather than two identical but 
independent quantum states. It makes a big difference from classical key. 

In classical case, two parties only need to share two classical bit strings 
with same content, then the encryption and decryption operations run suc¬ 
cessfully. On the other hand, if two parties share two identical but inde¬ 
pendent quantum states, the operations do not always work correctly. For 
example, assuming that Alice and Bob hold quantum state p = |-|-) as the 
key, Alice encrypts m = 0 according to the PROTOCOL [2l she will get: 

|0)a + cnot^ |0)a|0) + |1)a|1) 

\/2 \/2 ■ 

She holds the quantum state in register A, and sends the ciphertext to Bob. 
Then Bob preforms decryption operation on it and gets: 

|0)b + |i)b|0)a|0) + |i).4|i) 

\/2 \/2 

CHOT, |0)b(|0>.4|0> + |1UI1» + |i>b(|0UIi) + |iU|o)) 

The reduced density matrix of this result is 


, _ | 0 )( 0 | + | 1 )( 1 | 


(7) 


which is a ultimate mixed state and has nothing to do with plaintext m = 0. 

The situation is assorted by that the encryption process with the clas¬ 
sical key is uniform, so the decryption process with same key can decrypt 
successfully, while using the quantum key to preform the encryption op¬ 
eration on m, if the key is a superposition state |0fc) = where 

each \ki) controls a encryption process, the result should be a mixture of 
ciphertexts: Pc = Tiere Ei{\m){m\) is the ciphertext en¬ 

crypted by \ki). Then if Bob preforms decryption operation with same key 
the hnal result is the mixture of all Dj{Ei{\m){m\)). When i = j, 
Dj{Ei{\m){m\)) = |m)(m|, else Dj{Ei{\m){m\)) can collapse to any value. 

On the other hand, if we choose entangled state as the key, the quantum 
encryption and decryption become feasible again. Since two parties share 
the entangle state, even if the encryption process is a mixture of multiple 
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processes, the decryption will turn back to the same state. In the meantime, 
the mixed encryption will strengthen the security of protocol. 

It was Leung who presented the one time pad for quantum message with 
quantum keyj^. In this protocol, the quantum key can be recycling used and 
security is ensured. This means that even one qubit key can encrypt one qubit 
plaintext at once, the recycling property made the utilization efficiency of key 
high enough. Oppenheim and Horodecki then proved that the classical key 
in PQC protocol can be used repeatedly and partly and it can also ensure 
security of the protocol as long as the detection is performed after each 
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4. Type O 

There are six kinds of protocols belong to type O, which are not presented 
yet. We will give the structure ideas for two of them, and give the existence 
proof for the rest four of them. 

4 . 1 . Kind 2 

The Kind 2 protocol requests: P,C, K, E e C, D E Q. The idea of 
construction is based on the classical NP problems. As there exists quantum 
resolution algorithms for some classical NP problems, we can use classical 
NP problem to do encryption, and use quantum resolution algorithm as de¬ 
cryption algorithm. 

We take discrete logarithm problem for example, assume the resolution 
algorithm is : £{\a)\b)) = s for b = a^{mod q), and present the protocol as 
follow: 

PROCOTOL 5 {P,C,K,E G C, D eQ). Encryption: 

Let plaintext he x, and key be {g, h). 

1. Alice randomly chooses y G Zg, and calculates the ciphertext h^-m). 

2. Alice sends the ciphertext {g^, h^ ■ m) to Bob through classical channel. 

Decryption: 

1. Bob calculates £{\g)\g^)) = y. 

2. Bob gets m = ■ m/h^. 




J^.2. Kind 3 

The Kind 3 protocol requests: P,C, K, D E C, E E Q. The construction 
idea is based on the nature of quantum mechanics. We replace the classical 
random number algorithms with random collapse of quantum measurement. 

Assume (P, C,K, A, P, D) is a classical probabilistic symmetric-key en¬ 
cryption protocol[ll|. For example, according to the bit x, we randomly 
choose Xx = hi - ■ - ht satisfying x = 6i © • • • © 6*, then encrypt and the 
ciphertext turns out to be E{Xx, k). This protocol can hide the information 
of plaintext more effectively since each encryption process with the same 
plaintext turns out different ciphertexts. Based on this protocol, we give an 
example of the Kind 3 protocol as follow: 

PROCOTOL 6 {P,C, K, D G C, E eQ). Let plaintext x be a classical 
bit, and key be k. 

Encryption: 

1. Alice prepares quantum state based on x. 

2. Alice performs quantum encryption operation on 'Yhx,, y^^lA^)-' 

Ue(Y, V)I*:>|0» = E ^1 V)I*:>|B(A., k)). 

3. Alice measures the third reqister, the quantum state randomly collapses 
to E{Xx,k) 

4. Alice sends E{\x, k) to Bob. 

Decryption: 

1. Bob calculates D{E{Xx, k), k) = A^, with key k and gets x which is the 
parity bit of Xx- 

4-3. Rest ones 

For the rest four kinds of type O, Kind 4, 8, 20, 24, we give the existence 
proofs for them. 

1. The Kind 4 protocol requests P,C, K E C, E,D E Q. We can improve 
a simple classical symmetric-key encryption into this kind as follow: 
Take quantum circuits which realize the equivalent computational pro¬ 
cess to the classical encryption and decryption algorithms as the quan¬ 
tum encryption and decryption ones. Since P,C,K E C, the input 
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plaintext and key for quantum encryption algorithm will firstly be 
coded with |0), |1) basis, and the output ciphertext will be measured 
with |0), |1) basis too. For quantum decryption algorithm, the same 
process will be performed. Hence it comes out a Kind 4 protocol. 

2. The Kind 8 protocol requests P,C E C, K,E,D E Q. It comes out to 
be the same as the Kind 4 protocol except we take the quantum state 
coding from the classical key as the new protocol’s key. 

3. The Kind 20 and 24 protocols can be constructed as the same. 

However, this modihcation scheme can not take advantage on the security 
or practicability, it only proves the existence of these kinds of protocols. We 
hope some meaningful protocols can be presented in the future. 

5. Type N 

As we shown in Tab.l, there are 21 kinds of quantum symmetric-key 
encryption considered to be unable to construct, including the Kind 5-7, 
9-11, 13-15, 17-19, 21-23, 25-27 and 29-31 protocols. 

These kinds of protocol have one trait in common: they request at least 
one of the encryption and decryption algorithms belongs to classical space, 
meanwhile they request at least one of the plaintext, ciphertext, and key 
belongs to quantum space. This means they will take a quantum state as 
the input or output object of a classical algorithm, which is not valid. 

If a algorithm involve a quantum object, it must also belong to quantum 
space. Both encryption and decryption algorithms involve plaintext, cipher- 
text and key simultaneously. Encryption algorithm takes plaintext and key 
as input objects, and ciphertext as output object. Decryption algorithm 
takes ciphertext and key as input objects, and plaintext as output object. 
As a result, if one of the encryption and decryption algorithms belongs to 
classical space, the plaintext, ciphertext and key must all belong to classical 
space. Therefore these 21 kinds of quantum symmetric-key encryption are 
unable to construct. 

6. Discussion 

In this article there are six kinds of protocols belong to type O. These pro¬ 
tocols are only given theoretical structure scheme, which are inefficiency and 
not practical. How to hud an efficient structural scheme or prove there are no 


10 



effective ones is in our further study. In addition, we also study the classihca- 
tion of quantum public-key encryption protocol. Since its key has two parts 
to be considered, it must be classify under six-tuple (P, C, Gi, G 2 , E, D). For 
example, Min Liang and Li Yang present a quantum public-key encryption 
protocol [ 12 , ll3[, the secret key is a classical function P, the public key is a 
quantum state and a classical bit string Sj. 


7. Conclusions 

Quantum symmetric-key encryption protocol is generalized concept and 
includes the classical one in this article. Based on the quintuple of it, we 
classify the 32 kinds of quantum symmetric-key encryption protocols into 
three types. First type includes hve kinds of protocols that all have been 
presented yet and worth deeply studying. Second type includes six kinds 
of protocols that are only proved exist theoretically and worth discussing. 
The last type includes the rest 21 kinds, they are proved to be unable to 
construct as they request classical algorithm work on quantum target, which 
is not valid. We also suggest that the quantum key has a big difference 
from the classical key. Two parties should share two parts of an entangled 
state rather than two identical but independent quantum states, otherwise 
the encryption and decryption operations do not always work correctly. 
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